PRIVACY POLICY

• Email: info@joincresco.com
• Registered Address: 4391ResCo-Work05, Floor. 43, Addax Port Office Tower, Al Rayfa Street, Abu Dhabi, Al Reem Island, United Arab Emirates

3.1 Registration Data

When you create an account on the Platform, we collect:

• – your email address, verified by a one-time confirmation code sent at the point of registration;
• – your account password, stored in encrypted form; and
• – technical metadata associated with account creation, including device type, IP address, and timestamp.

3.2 Investment Profile and Onboarding Data

During the onboarding process, we collect the following categories of information as part of your Investment Profile:

• – investment management preference (discretionary delegation or advisory approval);
• – primary investment objective (e.g. capital preservation, income generation, long-term growth);
• – investment time horizon;
• – stated risk tolerance and behavioural risk preference, including your hypothetical response to a portfolio decline;
• – level of overall investment experience and familiarity with specific product types, including equities, ETFs, bonds, derivatives, structured products, and alternative investments;
• – the financial significance of the investment capital relative to your overall financial position;
• – the approximate proportion of your total assets represented by the investment; and
• – the primary source of investment funds (e.g. business income, employment income, investment returns, inheritance).

The Company does not collect identity documents, passport data, facial imagery, or any biometric information. Identity verification is the exclusive responsibility of Partner Advisors and Interactive Brokers, each of which operates its own independent KYC and AML procedures.

3.3 Portfolio and Transaction Data from Interactive Brokers

If you connect your Interactive Brokers account to the Platform, the following data is received and displayed in real time via the official IBKR Advisory Account API:

• – portfolio holdings and current valuations;
• – executed and pending transactions and trade history;
• – account number and account holder name; and
• – portfolio performance metrics as made available through the API.

This data is displayed on a read-only, real-time basis. The Company does not store portfolio or transaction data on its own servers. The Company does not access, store, or retain your Interactive Brokers login credentials, passwords, or personal access tokens.

3.4 Usage and Technical Data

When you access and use the Platform, we automatically collect:

• – IP address, browser type, and operating system;
• – pages visited, features used, time spent on the Platform, and clickstream data;
• – device identifiers and session information; and
• – cookie and tracking data, as further described in Section 10 of this Policy.

3.5 Communications Data

If you contact our support team by email or through the live chat function on the Platform, we retain the content of your communications and associated metadata for the purpose of resolving your enquiry and maintaining an accurate record of our interactions.

• – Account creation and authentication: to register your account, verify your email address, and manage your login credentials.
• – Investment profiling: to collect your investment preferences and generate an Investment Profile for use in matching you with suitable Partner Advisors and communicating your profile to your selected Partner Advisor.
• – Platform delivery and personalisation: to display your connected portfolio data, AI-generated summaries, Partner Advisor information, and investment ideas relevant to your profile.
• – Partner Advisor onboarding: to share your Investment Profile with the Partner Advisor you select, as part of the advisory relationship established by your advisory agreement.
• – AI Summary generation: to produce anonymised portfolio analytics summaries using a third-party AI provider, for your informational use only.
• – Customer support: to respond to your enquiries, resolve complaints, and maintain records of our interactions.
• – Platform security and fraud prevention: to monitor for and detect unauthorised access, abuse, and security incidents.
• – Compliance with applicable law: to comply with court orders, regulatory directions, or other legally binding obligations applicable to the Company in its capacity as a technology operator incorporated in the UAE.
• – Marketing communications: to send platform updates, newsletters, and promotional content, subject to your consent given at registration.

6.1 Partner Advisors

Upon your selection of a Partner Advisor and execution of an advisory agreement, your Investment Profile — comprising the information collected during the onboarding process as described in Section 3.2 — is shared with that Partner Advisor. Your selected Partner Advisor will also have visibility of your portfolio performance data, transaction history, active investments, and investment idea results through the CRM system, to the extent made available by your connected Interactive Brokers account. This data sharing is governed by and subject to the terms of your advisory agreement with the relevant Partner Advisor.

6.2 AI Provider (OpenAI)

Portfolio data is submitted to the OpenAI API for the purpose of generating AI Summaries. Prior to transmission, all data is anonymised: no personally identifiable information, account numbers, or individual-specific data is sent to OpenAI. The data is transmitted in the form of an anonymised portfolio description.

6.3 Interactive Brokers

Portfolio and transaction data is received from Interactive Brokers LLC through the official IBKR Advisory Account API. Interactive Brokers processes your account data pursuant to its own terms of service and privacy policy. The Company does not transfer personal data to Interactive Brokers; it receives and displays data from Interactive Brokers on a read-only basis.

6.4 Cloud Infrastructure Provider

User account data and platform operational data are stored on servers hosted by a major cloud infrastructure provider (currently Amazon Web Services or an equivalent enterprise-grade provider). All cloud providers engaged by the Company are required to maintain appropriate technical and organisational security measures consistent with industry standards. The specific hosting region will be confirmed and updated in this Policy upon infrastructure finalisation.

6.5 Analytics and Marketing Tools

The Platform uses third-party analytics and marketing tools, which may include services such as Google Analytics and similar platforms. These tools may collect usage data through cookies and similar tracking technologies. Please refer to Section 10 of this Policy and the Platform's Cookie Policy for further details.

6.6 Legal and Regulatory Disclosure

We may disclose personal data to competent governmental, regulatory, or judicial authorities if required to do so by applicable law, regulation, court order, or binding regulatory direction, or if we reasonably believe that such disclosure is necessary to protect the rights, property, or safety of the Company, its users, or the public.

6.7 Corporate Transactions

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of the Company's assets, personal data held by the Company may be transferred to the relevant successor entity, subject to that entity assuming obligations substantially equivalent to those set out in this Policy.

6.8 No Sale of Personal Data

The Company does not sell, rent, license or otherwise commercially exploit your personal data to any third party for that third party's own independent commercial purposes unrelated to the services you have requested. For the avoidance of doubt, the sharing of your Investment Profile and portfolio data with a partner Advisor as described in Section 6.1. does not constitute a sale or commercial exploitation of your personal data. Such sharing is carried out exclusively to perform the contractual relationship that you have chosen o enter into with that Partner Advisor, based on your explicit selection of that Partner Advisor and your execution of an advisory agreement. Such Partner Advisor receives your data solely to provide the advisory services, which you have requested, and not any independent commercial purpose of its own unrelated to the performance of such advisory relationship.

• – Right of access: to request confirmation of whether we process personal data about you and, if so, to obtain a copy of that data together with supplementary information about our processing activities.
• – Right to rectification: to request correction of any inaccurate or incomplete personal data we hold about you.
• – Right to erasure: to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to applicable retention obligations.
• – Right to restriction of processing: to request that we limit the processing of your personal data in certain circumstances, for example while the accuracy of your data is contested.
• – Right to data portability: to receive personal data you have provided to us in a structured, commonly used, and machine-readable format, where technically feasible.
• – Right to object: to object to processing of your personal data where it is based on the legitimate interests of the Company, including for direct marketing purposes.
• – Right to withdraw consent: where processing is based on your consent, to withdraw that consent at any time without affecting the lawfulness of prior processing.

11.1 Use of Cookies

The Platform uses cookies and similar tracking technologies for the following purposes: (i) essential cookies required for the operation and security of the Platform; (ii) functional cookies that remember your preferences and settings; and (iii) analytical and marketing cookies used to understand how users interact with the Platform and to deliver relevant communications. A detailed description of the specific cookies used is set out in the Platform's separate Cookie Policy.

11.2 Non-Essential Cookies and Consent

Non-essential analytical and marketing cookies are placed only with your prior consent. You may manage your preferences through the consent management tool on the Platform and may withdraw consent at any time without affecting your ability to access core platform features.

11.3 Third-Party Analytics

The Platform may use third-party analytics services, which may include Google Analytics and similar tools. These services may process usage data on servers located outside the UAE. Please refer to the respective third-party privacy policies for further information.

11.4 Marketing Communications

By completing the registration process, you consent to receive marketing and promotional communications from the Company, including platform updates and relevant market information. You may withdraw this consent at any time by clicking the unsubscribe link in any marketing email or by contacting us at info@joincresco.com. Withdrawal of marketing consent does not affect receipt of transactional and account-related communications, which are sent on the basis of contractual necessity.

• Data Controller: CRESCO TECHNOLOGIES LTD
• Registered Address: 4391ResCo-Work05, Floor. 43, Addax Port Office Tower, Al Rayfa Street, Abu Dhabi, Al Reem Island, United Arab Emirates
• Email: info@joincresco.com